Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2024-6788

Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHOENIX CONTACT CHARX SEC-3000

Default version status: unaffected

  • 0 to < 1.6.3affected

PHOENIX CONTACT CHARX SEC-3050

Default version status: unaffected

  • 0 to < 1.6.3affected

PHOENIX CONTACT CHARX SEC-3100

Default version status: unaffected

  • 0 to < 1.6.3affected

PHOENIX CONTACT CHARX SEC-3150

Default version status: unaffected

  • 0 to < 1.6.3affected

References